forked from ansible-lockdown/RHEL9-CIS
109 lines
3.1 KiB
YAML
109 lines
3.1 KiB
YAML
---
|
|
|
|
- name: Pre Audit | Setup the audit
|
|
ansible.builtin.include_tasks: LE_audit_setup.yml
|
|
when:
|
|
- setup_audit
|
|
tags:
|
|
- setup_audit
|
|
|
|
- name: "Pre Audit | Ensure {{ audit_conf_dir }} exists"
|
|
ansible.builtin.file:
|
|
path: "{{ audit_conf_dir }}"
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Pre Audit | retrieve audit content files from git
|
|
ansible.builtin.git:
|
|
repo: "{{ audit_file_git }}"
|
|
dest: "{{ audit_conf_dir }}"
|
|
version: "{{ audit_git_version }}"
|
|
when:
|
|
- audit_content == 'git'
|
|
|
|
- name: Pre Audit | confirm audit branch vs benchmark version
|
|
ansible.builtin.debug:
|
|
msg: "Audit will run the branch {{ audit_git_version }} for this Benchmark {{ benchmark_version }}"
|
|
|
|
- name: Pre Audit | copy to audit content files to server
|
|
ansible.builtin.copy:
|
|
src: "{{ audit_local_copy }}"
|
|
dest: "{{ audit_conf_dir }}"
|
|
mode: 0644
|
|
when:
|
|
- audit_content == 'copy'
|
|
|
|
- name: Pre Audit | get audit content from url
|
|
ansible.builtin.get_url:
|
|
url: "{{ audit_files_url }}"
|
|
dest: "{{ audit_conf_dir }}"
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
when:
|
|
- audit_content == 'get_url'
|
|
|
|
- name: Pre Audit | Check Goss is available
|
|
block:
|
|
- name: Pre Audit | Check for goss file
|
|
ansible.builtin.stat:
|
|
path: "{{ audit_bin }}"
|
|
register: goss_available
|
|
|
|
- name: Pre Audit | Alert if goss not available
|
|
ansible.builtin.assert:
|
|
that: goss_available.stat.exists
|
|
fail_msg: "Audit binary file {{ audit_bin }} does not exist"
|
|
when:
|
|
- run_audit
|
|
|
|
- name: "Pre Audit | Check whether machine is UEFI-based"
|
|
ansible.builtin.stat:
|
|
path: /sys/firmware/efi
|
|
register: rhel9_efi_boot
|
|
tags:
|
|
- goss_template
|
|
|
|
- name: Pre Audit | Copy ansible default vars values to test audit
|
|
ansible.builtin.template:
|
|
src: ansible_vars_goss.yml.j2
|
|
dest: "{{ audit_vars_path }}"
|
|
mode: 0600
|
|
when:
|
|
- run_audit
|
|
tags:
|
|
- goss_template
|
|
|
|
- name: "Pre Audit | Run pre_remediation {{ benchmark }} audit"
|
|
ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ pre_audit_outfile }} -g {{ group_names }}"
|
|
environment: "{{ audit_run_script_environment | default({}) }}"
|
|
changed_when: audit_run_pre_remediation.rc == 0
|
|
register: audit_run_pre_remediation
|
|
|
|
- name: Pre Audit | Capture audit data if json format
|
|
block:
|
|
- name: "Pre Audit | capture data {{ pre_audit_outfile }}"
|
|
ansible.builtin.shell: "cat {{ pre_audit_outfile }}"
|
|
register: pre_audit
|
|
changed_when: false
|
|
|
|
- name: Pre Audit | Capture pre-audit result
|
|
ansible.builtin.set_fact:
|
|
pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}"
|
|
vars:
|
|
summary: 'summary."summary-line"'
|
|
when:
|
|
- audit_format == "json"
|
|
|
|
- name: Pre Audit | Capture audit data if documentation format
|
|
block:
|
|
- name: "Pre Audit | capture data {{ pre_audit_outfile }}"
|
|
ansible.builtin.shell: "tail -2 {{ pre_audit_outfile }}"
|
|
register: pre_audit
|
|
changed_when: false
|
|
|
|
- name: Pre Audit | Capture pre-audit result
|
|
ansible.builtin.set_fact:
|
|
pre_audit_summary: "{{ pre_audit.stdout_lines }}"
|
|
when:
|
|
- audit_format == "documentation"
|